NetSec-Analyst Practice Exam 4 — 20 Questions

Question 1

Which TWO of the following characteristics apply to Service Objects in Strata Cloud Manager?

Accepted Answer

They allow the use of port ranges, such as 1000-2000.. Option B is correct because Service Objects in Strata Cloud Manager support port ranges (for example, 1000-2000) in addition to single ports, which lets administrators define a contiguous span of ports within one object rather than creating many individual entries. Option E is correct because Service Objects can be referenced inside Service Groups, and those groups can then be used in policy rules, simplifying and reducing the size of the rulebase. Option A is incorrect because tags are not automatically inherited from the policy rule a Service Object is applied to; tags are assigned to objects directly. Option C is incorrect because Service Objects are scoped to a folder/device group hierarchy and are not required to be globally unique across all Device Groups. Option D is incorrect because a Service Object defines a single protocol (TCP or UDP) with its port or port range, so TCP and UDP cannot be combined in one object.

Answer

They automatically inherit tags from the policy rule they are applied to.

Answer

They are globally unique across all Device Groups.

Answer

They support the definition of both TCP and UDP ports in a single object.

Question 2

A security analyst receives an alert that a critical server is communicating with a known malicious IP address. The analyst wants to block this traffic immediately without affecting other traffic. Which action should the analyst take?

Accepted Answer

Create a new security rule at the top of the rulebase denying traffic from the server to the malicious IP.. Creating a specific deny rule at the top of the security policy is the most precise way to block traffic between the server and the malicious IP. It ensures immediate enforcement and does not impact other traffic. Other methods like modifying existing rules or using URL filtering are either too broad or ineffective for IP-based blocking.

Answer

Add the malicious IP to a URL Filtering profile and apply it to the server's outbound rule.

Answer

Enable DNS Sinkhole to redirect the malicious IP to a block page.

Answer

Modify the existing outbound allow rule to deny all traffic from the server.

Question 3

When creating a Dynamic Address Group (DAG), what is the primary prerequisite for the object to populate successfully?

Accepted Answer

The IP address must have a tag associated with it via registration.. DAGs rely on Tags being registered to the IP address via VM-Series monitoring, XML API, or User-ID.

Answer

The interface must be configured as a DHCP server.

Answer

The IP address must be defined as a static Address Object.

Answer

The object must be added to a Service Group.

Question 4

Which THREE features are associated with an 'Application Filter'?

Accepted Answer

Technology. Application Filters group applications based on category, subcategory, and technology, and these filters update automatically as new applications are added to the PAN-OS database.

Answer

Destination port

Answer

Source IP address

Question 5

A security analyst is investigating a suspected data exfiltration attempt. The analyst needs to examine the packet payload of a specific session to determine if sensitive data is being transmitted. Which tool should the analyst use to capture and inspect the packet payload in real time?

Accepted Answer

Use the 'debug dataplane packet-diag set filter' command to set up a packet capture.. To inspect packet payload for data exfiltration, the analyst must capture raw packets. The 'debug dataplane packet-diag set filter' command enables setting up a packet capture filter on the dataplane. Once captured, the packets can be viewed or exported for analysis, revealing the payload. Other commands provide session metadata or policy information but lack the ability to show actual packet contents.

Answer

Use the 'show counter global' command to check for anomalies.

Answer

Use the 'show session id' command to view session details.

Answer

Use the 'test security-policy-match' command to check policy rules.

Question 6

A security analyst is reviewing firewall logs and notices that a specific internal host is generating a high volume of denied outbound connections to many external IP addresses on port 443. The analyst wants to quickly identify whether this host is compromised and what action to take. Which step should the analyst take first?

Accepted Answer

Review the Threat logs and WildFire verdicts for the host to identify malicious activity.. Threat logs and WildFire verdicts provide the evidence needed to determine whether the host is compromised, including malware detections and command-and-control signatures. Containment or remediation actions such as blocking or reimaging should follow confirmation, not precede it. Reviewing threat intelligence first ensures the response is justified and preserves forensic data.

Answer

Reset the host's network adapter and reimage the operating system.

Answer

Disable the security policy rule that denies the traffic to allow further observation.

Answer

Create a deny rule for the internal host to stop all outbound traffic immediately.

Question 7

When creating a NAT policy, which field defines the address that the traffic will be translated to on the destination side?

Accepted Answer

Translated Address. In a NAT policy, the Translated Address field (sometimes labeled 'Translated Packet' or 'NAT Translated Address') specifies the IP address that the original source or destination is rewritten to. For destination NAT (DNAT), this is the internal address that external traffic is redirected to; for source NAT (SNAT), it is the public address outbound traffic appears to come from. The field name explicitly describes the post-translation address.

Answer

Destination Address

Answer

Service Port

Answer

Source Address

Question 8

An administrator wants to schedule signature updates to occur at 3:00 AM daily. Where is this configured?

Accepted Answer

Device > Dynamic Updates. The Device > Dynamic Updates page contains the schedule settings for various update types like Applications, Threats, and WildFire.

Answer

Policies > Security > Schedules

Answer

Monitor > Reports > Schedules

Answer

Device > Setup > Services

Question 9

What is the primary purpose of a 'Device Group' in the context of SCM?

Accepted Answer

To apply consistent security policies to multiple firewalls.. Device groups allow for the hierarchical grouping of firewalls for shared policy management, providing consistent security across the enterprise.

Answer

To group firewalls by physical location only.

Answer

To manage local user authentication.

Answer

To manage interface settings exclusively.

Question 10

A security analyst is reviewing the firewall's configuration to ensure that all administrative changes are logged and can be traced back to the individual administrator. The analyst notices that all administrators are using the default 'admin' account. Which action should the analyst recommend to meet the requirement for accountability?

Accepted Answer

Create individual administrator accounts with unique usernames and assign appropriate roles.. Individual administrator accounts with unique usernames are essential for accountability because they allow the firewall to log each administrative action with the specific user who performed it. Shared accounts, even with strong authentication, cannot provide this traceability. Assigning roles ensures least privilege, but the key is unique identification. This approach is a fundamental security best practice.

Answer

Configure a syslog server to capture all configuration changes and correlate them with the 'admin' account.

Answer

Enable multi-factor authentication for the 'admin' account to ensure only authorized personnel can make changes.

Answer

Enable RADIUS authentication and map each administrator to the 'admin' role.

Question 11

What is the 'Read-Only' state of an object indicating in SCM?

Accepted Answer

The object is inherited from a parent device group. An object is read-only if it is inherited from a parent device group, meaning it cannot be modified at the current level.

Answer

The administrator lacks permissions

Answer

The object is corrupted

Answer

The object is in use by a rule

Question 12

Which of the following are benefits of using Device Groups in SCM? (Choose THREE)

Accepted Answer

Inheritance of configuration. Device Groups in Palo Alto Networks Strata Cloud Manager (SCM) are hierarchical containers that let child folders/devices automatically receive settings defined at a parent level, so option B (Inheritance of configuration) is correct because policies, objects, and profiles flow down the hierarchy without being recreated per device. Option C (Shared object management) is correct because objects such as address objects, tags, and security profiles defined in a Device Group can be referenced by all member devices, eliminating duplicate definitions. Option E (Configuration modularity) is correct because Device Groups let you organize configuration into reusable, layered building blocks (for example, a baseline group plus site-specific groups) that can be mixed and matched across deployments. Option A (Local-only access) is not a benefit of Device Groups, since Device Groups are precisely a mechanism for centralized, hierarchical management rather than restricting configuration to a single local device. Option D (Automatic hardware replacement) is not a Device Groups feature; hardware replacement/RMA is handled through device onboarding and licensing workflows, not through Device Group membership.

Answer

Local-only access

Answer

Automatic hardware replacement

Question 13

How does an administrator perform a software update on a standalone firewall?

Accepted Answer

Device > Software. Software updates are managed in the Device > Software page, where you can download and install new versions of PAN-OS.

Answer

Network > Interfaces

Answer

Objects > Software

Answer

Device > Dynamic Updates

Question 14

Which TWO methods can be used to identify traffic using App-ID when port-based rules are insufficient?

Accepted Answer

Behavioral analysis of the traffic flow.. Option A is correct because App-ID can identify applications through behavioral analysis, observing session characteristics such as packet timing, payload sizes, and flow patterns to distinguish applications that cannot be reliably separated by port alone. Option C is correct because App-ID relies on Deep Packet Inspection (DPI) signatures that match application-specific protocol patterns and payload content, which is exactly how it identifies traffic when port-based rules are insufficient. Options B, D, and E do not belong: IP address reputation filtering and MAC address filtering identify hosts or devices rather than applications, and URL filtering categories classify web destinations rather than the application generating the traffic.

Answer

IP address reputation filtering.

Answer

MAC address filtering.

Answer

URL filtering categories.

Question 15

Traffic is failing the 'Service' check in a security policy. Which CLI tool can be used to confirm which application is being identified for a specific source-destination pair?

Accepted Answer

test security-policy-match. The 'test security-policy-match' tool simulates a policy lookup to determine which rule and application-ID will be matched for a given flow.

Answer

debug dataplane packet-diag

Answer

show session all

Answer

show policy rulebase

Question 16

An administrator is creating a new Service Group that will contain several Service Objects for different applications. They want to ensure that the Service Group can be used in a Security Policy to allow traffic for all the services. However, they also want to minimize the number of objects they need to manage. Which of the following is a valid consideration when creating a Service Group?

Accepted Answer

A Service Group can contain other Service Groups, allowing hierarchical grouping.. Service Groups can contain other Service Groups, allowing for nested groupings. This hierarchical structure helps organize services and reduce the number of objects referenced in policies. The other options are incorrect: Service Groups can contain mixed protocols, do not require port ranges, and can be modified after being referenced.

Answer

A Service Group can only contain Service Objects of the same protocol (TCP or UDP).

Answer

A Service Group can only be used in a Security Policy if it contains at least one Service Object with a port range.

Answer

A Service Group cannot be modified after it is referenced in a Security Policy.

Question 17

In a scenario where you use an Application Object in a Security Policy, how does the firewall identify the traffic?

Accepted Answer

By App-ID inspection. The firewall uses App-ID, which performs deep packet inspection to identify the application, regardless of the port being used.

Answer

By the DNS request

Answer

By the source IP

Answer

By the destination port

Question 18

You want to color-code objects in Strata Cloud Manager to improve visibility. Which feature do you use?

Accepted Answer

Tags. Tags are used to provide metadata, including colors, to objects for better organization and visual identification.

Answer

Device Groups

Answer

Descriptions

Answer

Object Filtering

Question 19

A NetSec-Analyst is configuring a Dynamic Address Group (DAG) that should include all servers tagged as 'Web'. The analyst notices that some servers with the 'Web' tag are not appearing in the DAG. The tags are applied via a VM monitoring agent. What is the most likely cause?

Accepted Answer

The DAG filter is case-sensitive and the tag is 'web' instead of 'Web'.. Dynamic Address Group filters match tags or metadata exactly, including case. If the tag is registered as 'web' but the filter expects 'Web', those servers will not be included. Checking tag casing and consistency is the first troubleshooting step.

Answer

The VM monitoring agent is not licensed for dynamic address groups.

Answer

The servers are in a different security zone than the DAG.

Answer

The DAG filter requires an IP address instead of a tag.

Question 20

If an administrator wants to ensure that a specific server can only be accessed from a specific internal subnet, where is this best configured?

Accepted Answer

Security Policy. The Security Policy is the correct place to enforce source-to-destination-to-application access control.

Answer

Decryption Policy

Answer

NAT Policy

Answer

QoS Policy